For a $1,500 entry fee and $500 a month, EvilTokens could feed an AI assistant up to 5,000 recent messages from a compromised Microsoft mailbox. The assistant's more damaging job began after login: sort the inbox, map who could approve payments, find pending invoices, and help an attacker choose whom to impersonate. SpyCloud says the service could pull that batch through Microsoft Graph. The price and throughput turn a slow part of business email fraud into a product feature.
Within months of its February 2026 launch, Microsoft linked EvilTokens to more than 12,000 compromised inboxes at over 10,000 organizations. The company and its partners have now taken down much of the service's infrastructure. Microsoft says it seized 50 websites, disabled more than 150 related domains, and supported an investigation that led UK police to arrest two men. Both were released on police bail, so the arrests are part of an active investigation rather than a finding of guilt.
The takedown is important, but the count of seized domains misses the operational lesson. EvilTokens packaged the time between account access and payment fraud. Microsoft tells organizations to assume that a criminal who enters an inbox may understand its contents in minutes. Security teams that treat a password reset as the end of the incident are working against the wrong clock.
The product covered the whole attack chain
Microsoft tracks the developer and operator behind EvilTokens as Storm-2992. According to the company's technical account of the operation, the service was advertised through Telegram, where subscribers received updates and support. The base kit included a control panel, phishing templates, hosting and redirect settings, victim tracking, and captured-token management. Extra products, such as an anti-bot redirector and mail-sending tools, cost more.
The panel had 44 visual themes for email templates and landing pages. Operators could choose deployment infrastructure, page language, CAPTCHA behavior, lure layout, and an AI mode. Once a token arrived, the panel offered automatic inbox scans, keyword alerts through Telegram, administrator detection, and token refresh. Microsoft says the service also rewarded customer referrals with cryptocurrency. This looked closer to a commercial software dashboard than a folder of phishing files.
AI appeared on both sides of the product. Microsoft investigators found evidence that large portions of EvilTokens had been built with AI-assisted coding and that the service drew on more than one model. Its customers then used AI to draft targeted lures, translate messages, summarize stolen mail, trace reporting lines, and locate people with authority over money. Ars Technica's report describes the same shift in practical terms: one subscription brought account compromise, inbox analysis, target selection, and fraud preparation into a single workflow.
That packaging explains the scale better than a claim that AI made phishing prose more convincing. SpyCloud recovered data tied to 8,708 successfully compromised accounts across 6,585 corporate email domains in 79 countries. Only 216 accounts in its dataset belonged to free webmail services, leaving 97.5% attached to enterprise domains. The top 10 EvilTokens customers accounted for 60% of the victims SpyCloud observed. A small group of paying operators could run focused campaigns without building the token theft and mailbox-analysis stack themselves.
A legitimate Microsoft page completed the theft
EvilTokens abused OAuth device authorization, a flow intended for televisions, printers, conference-room hardware, and other devices that cannot present a normal sign-in form. In the legitimate sequence, a device requests a code, shows it to the user, and polls the identity provider while the user enters the code in a browser. Microsoft's protocol documentation gives the user 15 minutes by default and returns access and refresh tokens to the requesting client after approval.
The phishing kit initiated that request itself. A lure sent the victim to a page that generated a live code, copied it to the clipboard, and opened Microsoft's genuine device-login site. EvilTokens polled its backend every three to five seconds while the victim pasted the code and completed the prompt. If the victim was already signed in, one confirmation could authorize the attacker's session. Otherwise, the victim entered a password and completed MFA on Microsoft's own domain. The password did not need to pass through the phishing page.
That detail breaks two familiar safety signals at once. The final login domain can be real, and MFA can succeed, while the resulting tokens still go to a session the attacker initiated. Microsoft says EvilTokens operators sometimes registered a new device and obtained a Primary Refresh Token within ten minutes of compromise. Other operators waited before adding inbox rules or exporting mail, which made the activity less obvious.
A password change may also leave work unfinished. SpyCloud notes that access tokens can remain usable until they expire, while hybrid or federated tenants may not propagate revocation cleanly. An attacker may have added a device, authentication method, application registration, or inbox rule in the meantime. The incident response boundary therefore has to include sessions, tokens, devices, mailbox rules, and new identity objects, not only the user's password.
The AI advantage arrived after compromise
The assistant's value was its access to authentic context. Microsoft says preset prompts could search for wire transfers, identify the organization's "money movers," locate vendor invoices, and choose useful people to impersonate. Microsoft Graph reconnaissance could map roles and permissions as soon as a token was secured. That gave a subscriber the raw material for a reply that fit an existing relationship or payment process.
The victim pattern supports that reading. SpyCloud found weekday compromises ran at about seven times the weekend rate, with only 5.4% of observed sessions captured on Saturday or Sunday. Activity peaked during North American business hours. Among the 12 highest-volume EvilTokens customers, an average of 74% of each customer's victims came from a single country. Those figures point to operators targeting working organizations at useful times, rather than a random consumer phishing blast.
This is where the often vague phrase "AI-enabled cybercrime" becomes concrete. The model did not need a new exploit or autonomous control of an account. Stolen access supplied verified names, conversations, invoice language, and approval relationships. The assistant reduced the labor required to read those records and decide which thread had financial value. Microsoft's warning that an inbox can be understood in minutes follows directly from that workflow.
The takedown does not revoke every token
Microsoft's Digital Crimes Unit and Health-ISAC obtained authorization from a US federal court for the disruption. Microsoft lists Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, Shadowserver, and TRM Labs among the participating organizations. The company says it notified affected customers and helped remediate compromised accounts. On September 11, UK officers arrested men aged 32 and 38 and seized devices for examination, according to Microsoft's account.
Taking domains and control panels offline interrupts sales, support, redirects, and parts of the phishing infrastructure. It does not automatically erase access already issued by Microsoft Entra. SpyCloud warns that exposed session and refresh tokens can remain exploitable after a service is dismantled. It also says other commodity phishing platforms use device-code capture, so defenders cannot treat the EvilTokens name as the lasting indicator.
The distinction matters for anyone investigating a past alert. A closed phishing domain can explain how access began while the live risk sits elsewhere: a refresh token, a newly registered device, a forwarding rule, or a trusted internal email sent after takeover. Infrastructure indicators help find the campaign. Identity and mailbox evidence determine whether the campaign still has access.
Response now has to beat the inbox scan
Microsoft recommends blocking device-code flow wherever an organization does not need it. Tenants that require it for Teams hardware can narrow the exception to specific resource accounts and keep device registration outside that exception. This removes the abused path for most users while preserving it for hardware that genuinely depends on the flow.
Detection has to follow the sequence after authorization. Microsoft's published Defender signals include anomalous device-code authentication, suspicious token exchange, device registration after that login, unusual volumes of Microsoft Graph requests, and malicious inbox-rule creation. Those events tell a more complete story when correlated. A successful MFA event on its own can look reassuring even though it authorized the wrong session.
For a suspected compromise, Microsoft advises revoking refresh tokens and disabling related devices. Its researchers say standard session revocation may leave existing access tokens active for as long as an hour, so they recommend temporarily disabling the affected account when immediate containment matters. Teams should inspect new authentication methods, application consent, device registrations, Graph activity, forwarding settings, and inbox rules before restoring access.
Payment controls sit outside the identity stack. Microsoft recommends verifying requests to redirect funds, change payment details, or approve an unusual transfer through a trusted second channel. That step addresses the part EvilTokens automated best: turning real mailbox context into a request that sounds routine to the person receiving it.
The next useful measure of this disruption will be whether token-capture activity falls after the seized domains disappear, and whether another subscription service absorbs the same customers. EvilTokens made mailbox reconnaissance cheap enough to list beside templates and hosting in a control panel. Defenders now have a narrower window to revoke the session, inspect the mailbox, and call the person named on the invoice before a $500-a-month tool finishes reading it.